For securing REST APIs, a logical choice for access control is JWT either by itself or in combination with OAuth. If I only care about authenticating the caller, verifying a JWT signature is sufficient by itself. If I also care about authorization, I would also use OAuth, or some kind of token service. Either way I am including a header like
Authorization: Bearer [JWT token] in the HTTP request.
AWS has its own standard for API access control where you sign parts of the request itself and include a header like
Authorization: AWS4-HMAC-SHA256 ....
is the AWS approach more secure against replay attacks? I think yes, because even if you have a short token expiration, it's still hypothetically possible to reuse a bearer token on a different request. The signature means the request hasn't been tampered with.
if it is more secure, should it be considered an industry standard like OAuth and JWT? To what extent do standard app frameworks provide support on the validation side? etc.